Note: This is an archival copy of Security Sun Alert 200875 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com
as Sun Alert 1000664.1.

A security vulnerability in Sun ONE/Java System Directory Server may allow a local or remote unprivileged user to reveal existence of an entry's attributes, which are otherwise not visible to the user.

Contributing Factors

This issue can occur in the following releases for all platforms (Solaris 8, 9, and 10 on Solaris SPARC and x86 Platforms, Linux, Windows, HP-UX, and AIX):

Native Package Versions:

Sun ONE Directory Server 5.2

Sun Java System Directory Server 5 2003Q4 (5.2 Patch 1)

Sun Java System Directory Server 5 2004Q2 (5.2 Patch 2)

Sun Java System Directory Server 5 2005Q1 (5.2 Patch 3)

Sun Java System Directory Server 5 2005Q4 (5.2 Patch 4)

Sun Java Directory Server Enterprise Edition (DSEE) 6.0

PatchZIP (Compressed Archive) versions:

Sun ONE Directory Server 5.1

Sun One Directory Server 5.2

Sun Java System Directory Server 5.2 Patch 2

Sun Java System Directory Server 5.2 Patch 3

Sun Java System Directory Server 5.2 Patch 4

Sun Java Directory Server Enterprise Edition (DSEE) 6.0

To determine the version of Directory Server running on a system, the following command can be used:

Sun Java System Directory Server Enterprise Edition 6.1, as delivered in the following:

Native Package Versions:

Solaris SPARC: 125276-02

Solaris 9 x86: 125277-02

Solaris 10 x86/x64: 125278-02

Linux: 125309-02

HP-UX: 125310-02

PatchZIP (Compressed Archive) Versions:

Solaris SPARC: 126748-01

Solaris 9 x86: 126749-01

Solaris 10 x86/x64: 126750-01

Linux: 126751-01

Windows: 126753-01

HP-UX: 126752-01

Note 1: Sun Java System Directory Server 5.1 is also affected by this issue. In order to resolve this issue, users should upgrade to Sun Java System Directory Server 5.2 and apply the resolution listed in this section.

Note 2: Sun Java System Directory Server 6.0 must be upgraded to 6.1 using one of the above listed patches to resolve this issue.